Advertisement
captmicro

Untitled

Mar 27th, 2011
264
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.63 KB | None | 0 0
  1. #include "MicroHook.h"
  2.  
  3. /*returns pointer to existing function*/
  4. BYTE *MH_VTBLHook(DWORD *pVTBL, DWORD dwIdx, BYTE *pNewFunc)
  5. {
  6.     BYTE *pOrigFunc;
  7.     DWORD dwOldProt;
  8.     VirtualProtect((void*)&pVTBL[dwIdx], 4, PAGE_EXECUTE_READWRITE, &dwOldProt);
  9.     pOrigFunc = (BYTE*)pVTBL[dwIdx];
  10.     pVTBL[dwIdx] = (DWORD)pNewFunc;
  11.     VirtualProtect((void*)&pVTBL[dwIdx], 4, dwOldProt, &dwOldProt);
  12.     return pOrigFunc;
  13. }
  14.  
  15. /*returns pointer to trampoline function*/
  16. BYTE *MH_TrampolineAdd(BYTE *pOrigFunc, BYTE *pNewFunc, BYTE *pTrampolineFunc, BYTE bSize)
  17. {
  18.     BYTE bTemp;
  19.     DWORD dwOldProt;
  20.     BYTE bTrampEndSize;
  21.     VirtualProtect((void*)pTrampolineFunc, bSize+5, PAGE_EXECUTE_READWRITE, &dwOldProt);
  22.     VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
  23.     bTemp = bSize;
  24.     while (bTemp-- > 0) pTrampolineFunc[bTemp] = pOrigFunc[bTemp];
  25.     pTrampolineFunc += bSize;
  26.     pTrampolineFunc[0] = 0xE9; //JMP [rel16/32]
  27.     *(DWORD*)(pTrampolineFunc+1) = (DWORD)((pOrigFunc+bSize - pTrampolineFunc) - 5);
  28.     pOrigFunc[0] = 0xE9; //JMP [rel16/32]
  29.     *(DWORD*)(pOrigFunc+1) = (DWORD)((pNewFunc - pOrigFunc) - 5);
  30.     bTemp = 5; while (bTemp++ < bSize) pOrigFunc[bTemp] = 0x90;
  31.     VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
  32.     return (pTrampolineFunc - bSize);
  33. }
  34.  
  35. /*returns pointer to trampoline function*/
  36. BYTE *MH_TrampolineRemove(BYTE *pOrigFunc, BYTE *pTrampolineFunc, BYTE bSize)
  37. {
  38.     DWORD dwOldProt;
  39.     VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
  40.     while (bSize-- > 0) pOrigFunc[bSize] = pTrampolineFunc[bSize];
  41.     VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
  42.     return pTrampolineFunc;
  43. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement